feat(output): add SPDX 2.3 SBOM output with findings attached

[sonukapoor]

Note: this is an in-house item already being handled by the maintainer - not open for contribution. Filed for tracking only.

Problem

CVE Lite CLI emits CycloneDX 1.4 via --cdx but has no SPDX output. SPDX is the format named in US Executive Order 14028 and the one federal and regulated buyers most often ask for by name.

Snyk's snyk sbom produces both formats, but its SBOM is inventory-only: scanning this repo with --format=spdx2.3+json yields zero vulnerability references across all 43 packages. Vulnerability data is a separate product surface. Their SBOM generation is also plan-gated and requires network access.

That leaves a gap worth filling: a free, offline-capable tool that emits both SBOM formats with the findings already attached.

Proposed change

Add --sbom <format> accepting cyclonedx, spdx and spdx2.3, keeping --cdx as a permanent alias so existing pinned workflows are unaffected. Add --sbom-inventory-only to drop the vulnerability overlay for SBOMs feeding diffing, archival or attestation.

Design points worth recording:

• SPDX 2.3 has no vulnerability model. Findings attach as SECURITY external references of type advisory, which is the mechanism the specification defines. Severity and the runnable fix command go into a package annotation, because referenceLocator must be a URI and a shell command is not one. The SPDX overlay is therefore genuinely thinner than the CycloneDX one, and the docs must say so rather than imply severity ratings survive.
• Licenses come from the lockfile. npm records a declared license per package in package-lock.json, so npm projects get real license data at no network cost. pnpm, Yarn and Bun lockfiles do not carry licenses and resolve to NOASSERTION.
• NTIA minimum elements. The document should carry all seven fields, which means emitting supplier and real dependency relationships, not just a flat package list.
• filesAnalyzed must be false. Omitting it defaults to true, asserting we inspected package contents when we only read lockfile metadata.

Validation target

Output should line up with snyk sbom on the same project: identical package set and a comparable dependency graph, plus the vulnerability overlay Snyk does not provide.

Known follow-ups

• feat(action): add sbom input so SPDX output is reachable from the GitHub Action #1078 - the GitHub Action has no sbom input, so SPDX is unreachable from the action
• fix(parser): five-path cap leaves gaps in the SBOM dependency graph #1079 - the five-path cap leaves gaps in the dependency graph on large trees
• feat(cyclonedx): CycloneDX output is pinned to 1.4, three minor versions behind the spec #1080 - CycloneDX output is pinned to 1.4, three minor versions behind the spec